Serverless Development Deep Dive

© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Paul Maddox, Amazon Web Services
Developer Technologies
March 2018
Serverless Development
Deep Dive

About me
Paul Maddox
Developer Technologies
Amazon Web Services
• 16 years of dev, sysadmin, and systems architecture background.
• Awful at keeping track of time when coding.
• Awful at staying away from coding.
• Go/Java/C/Node
• Creator of AWS SAM Local
Twitter: @paulmaddox
Email: pmaddox@amazon.com
@paulmaddox

"Serverless requires me to develop in
a completely different way"
Myth Busting Time…

What to expect from this session
• Overview of serverless development
• Building a serverless API
• CI/CD with AWS CodeBuild/CodePipeline
• Development Frameworks
• Deploying with AWS SAM
• Testing/debugging locally with AWS SAM Local
• Security
• Amazon Cognito User Pools
• Customer Authorizers

A serverless world…
No servers to provision
or manage
Scales with usage
Never pay for idle Availability and fault
tolerance built in

Event based architectures
SERVICES (ANYTHING)
Changes in
data state
Requests to
endpoints
Changes in
resource state
EVENT SOURCE FUNCTION
Node.js
Python
Java
C#

Common serverless use cases
Web
applications
• Static
websites
• Complex web
apps
• Packages for
Flask and
Express
Data
processing
• Real-time
• MapReduce
• Batch
Chatbots
• Powering
chatbot logic
Backends
• Apps and
services
• Mobile
• IoT
</></>
Amazon
Alexa
• Powering
voice-enabled
apps
• Alexa Skills
Kit
IT
automation
• Policy engines
• Extending
AWS services
• Infrastructure
management

Using AWS Lambda
Bring your own code
• Node.js, Java, Python,
C#, Go
• Bring your own libraries
(even native ones)
Simple resource model
• Select power rating
from 128 MB to 3 GB
• CPU and network
allocated
proportionately
Flexible use
• Synchronous or
asynchronous
• Integrated with other
AWS services
Flexible authorization
• Securely grant access to
resources and VPCs
• Fine-grained control for
invoking your functions

Using AWS Lambda
Authoring functions
• WYSIWYG editor or
upload packaged .zip
• Third-party plugins
(Eclipse, Visual Studio)
Monitoring and
logging
• Metrics for requests,
errors, and throttles
• Built-in logs to Amazon
CloudWatch Logs
Programming model
• Use processes, threads,
/tmp, sockets normally
• AWS SDK built in
(Python and Node.js)
Stateless
• Persist data using
external storage
• No affinity or access to
underlying
infrastructure

Fine-grained pricing
Buy compute time in 100-ms increments
Low request charge
No hourly, daily, or monthly minimums
No per-device fees
Never pay for idle
Free Tier
1 M requests and 400,000 GB-s of compute
Every month, every customer

SMART RESOURCE ALLOCATION
Match resource allocation (up to 3 GB!) to logic
Stats for Lambda function that calculates 1000 times all prime
numbers <= 1000000
128 MB 11.722965 sec $0.024628
256 MB 6.678945 sec $0.028035
512 MB 3.194954 sec $0.026830
1024 MB 1.465984 sec $0.024638

Amazon S3 Amazon
DynamoDB
Amazon
Kinesis
AWS
CloudFormation
AWS CloudTrail Amazon
CloudWatch
Amazon
Cognito
Amazon SNSAmazon
SES
Cron events
DATA STORES ENDPOINTS
DEVELOPMENT AND MANAGEMENT TOOLS EVENT/MESSAGE SERVICES
Event sources that trigger AWS Lambda
…and more!
AWS
CodeCommit
Amazon
API Gateway
Amazon
Alexa
AWS IoT AWS Step
Functions

Lambda execution model
Synchronous (push) Asynchronous (event) Stream-based
Amazon
API Gateway
AWS Lambda
function
Amazon
DynamoDBAmazon
SNS
/order
AWS Lambda
function
Amazon
S3
reqs
Amazon
Kinesis
changes
AWS Lambda
service
function

Amazon API Gateway
Internet
Mobile Apps
Websites
Services
AWS Lambda
functions
AWS
All private (VPC) or
publicly accessible
endpoints
Amazon
CloudWatch
Monitoring
Amazon
CloudFront
Any other
AWS service
Endpoints on
Amazon EC2
AWS Step
Functions

Create a unified
API front end for
multiple
microservices
Authenticate and
authorize
requests to a
backend
DDoS protection
and throttling for
your backend
Throttle, meter,
and monetize API
usage by third-
party developers
Amazon API Gateway

Amazon API Gateway – Lambda Proxy Integration
{
"resource": "Resource path",
"path": "Path parameter",
"httpMethod": "Incoming request's method name",
"headers": {Incoming request headers},
"queryStringParameters": {Query string parameters},
"pathParameters":{Path parameters},
"stageVariables": {Applicable stage variables},
"requestContext": {Request context, including authorizer-returned key-value pairs},
"body": "...",
"isBase64Encoded": true|false
}
{
"statusCode": httpStatusCode,
"headers": { "headerName": "headerValue", ... },
"body": "...”,
"isBase64Encoded": true|false
}
Input Format of a Lambda Function for Proxy Integration
Output Format of a Lambda Function for Proxy Integration

© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Building an API with Serverless

Frameworks
Chalice

ClaudiaJS
Node.js framework for deploying projects
to AWS Lambda and Amazon API
Gateway
• Has sub projects for microservices,
chat bots and APIs
• Simplified deployment with a single
command
• Use standard NPM packages, no need
to learn swagger
• Manage multiple versions
https://claudiajs.com
https://github.com/claudiajs/claudia
app.js:
var ApiBuilder =
require('claudia-api-builder')
var api = new ApiBuilder();
module.exports = api;
api.get('/hello', function () {
return 'hello world';
});
$ claudia create --region us-east-1 --api-module app

Chalice
Python serverless “microframework” for
AWS Lambda and Amazon API Gateway
• A command line tool for creating,
deploying, and managing your app
• A familiar and easy to use API for
declaring views in python code
• Automatic Amazon IAM policy
generation
https://github.com/aws/chalice
https://chalice.readthedocs.io
app.py:
from chalice import Chalice
app =
Chalice(app_name="helloworld")
@app.route("/")
def index():
return {"hello": "world"}
$chalice deploy
Chalice

Chalice – a bit deeper
from chalice import BadRequestError
app = Chalice(app_name='apiworld-hot')
FOOD_STOCK = {
'hamburger': 'yes’,
'hotdog': 'no'
}
@app.route('/')
def index():
return {'hello': 'world'}
@app.route('/list_foods')
def list_foods():
return FOOD_STOCK.keys()
@app.route('/check_stock/{food}')
def check_stock(food):
try:
return {'in_stock': FOOD_STOCK[food]}
except KeyError:
raise BadRequestError("Unknown food '%s', valid choices are: %s" % (food, ', '.join(FOOD_STOCK.keys())))
@app.route('/add_food/{food}', methods=['PUT'])
def add_food(food):
return {"value": food}
Chalice

Chalice – a bit deeper
FOOD_STOCK = {
'hamburger': 'yes’,
'hotdog': 'no'
}
@app.route('/')
def index():
return {'hello': 'world'}
def list_foods():
@app.route('/check_stock/{food}')
try:
except KeyError:
@app.route('/add_food/{food}', methods=['PUT'])
def add_food(food):
Chalice
application routes
error handling
http method support

Meet
SAM!

AWS Serverless Application Model (SAM)
CloudFormation extension optimized for
serverless
New serverless resource types: functions, APIs,
and tables
Supports anything CloudFormation supports
Open specification (Apache 2.0)
https://github.com/awslabs/serverless-application-model

SAM template
AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Resources:
GetHtmlFunction:
Type: AWS::Serverless::Function
Properties:
CodeUri: s3://sam-demo-bucket/todo_list.zip
Handler: index.gethtml
Runtime: nodejs4.3
Policies: AmazonDynamoDBReadOnlyAccess
Events:
GetHtml:
Type: Api
Properties:
Path: /{proxy+}
Method: ANY
ListTable:
Type: AWS::Serverless::SimpleTable

SAM template
AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Resources:
GetHtmlFunction:
Type: AWS::Serverless::Function
Properties:
CodeUri: s3://sam-demo-bucket/todo_list.zip
Handler: index.gethtml
Runtime: nodejs4.3
Policies: AmazonDynamoDBReadOnlyAccess
Events:
GetHtml:
Type: Api
Properties:
Path: /{proxy+}
Method: ANY
ListTable:
Type: AWS::Serverless::SimpleTable
Tells CloudFormation this is a SAM
template it needs to “transform”
Creates a Lambda function with the
referenced managed IAM policy,
runtime, code at the referenced zip
location, and handler as defined.
Also creates an API Gateway and
takes care of all
mapping/permissions necessary
Creates a DynamoDB table with 5
Read & Write units

Tip: SAM templates can contain
ANY AWS CloudFormation resource

SAM template
<- this
becomes
this ->

Chalice – generating a SAM template
$ chalice package out
Creating deployment package
$ tree out
Out
├── deployment.zip
└── sam.json
0 directories, 2 files
Chalice

Introducing SAM Local
CLI tool for local testing of serverless apps
Works with Lambda functions and “proxy-
style” APIs
Response object and function logs available
on your local machine
Currently supports Java, Node.js and Python
https://github.com/awslabs/aws-sam-local

If(!feelingLucky) {
demogods.pray();
}
demo.start();

InternetMobile/Web
apps
AWS Lambda
functions
AWS
API Gateway
Other AWS
services
What we just deployed…

Security is job zero.

The serverless API stack
places where we can secure our application
InternetMobile/Web
apps
AWS Lambda
functions
AWS
API Gateway
Other AWS
services

Amazon API Gateway Security
Several mechanisms for adding Authz/Authn to our API:
• IAM Permissions
• Use IAM policies and AWS credentials to grant access
• Custom Authorizers
• Use Lambda to validate a bearer token (OAuth or SAML as
examples) or request parameters and grant access
• Cognito User Pools
• Create a completely managed user management system

Cognito User Pools
Add user sign-up and sign-
in easily to your mobile and
web apps without worrying
about server infrastructure
Serverless Authentication
and User Management
Verify phone numbers and
email addresses and offer
multi-factor authentication
Enhanced Security
Features
Launch a simple, secure,
low-cost, and fully
managed service to create
and maintain a user
directory that scales to
100s of millions of users
Managed User Directory
1 2 3

Cognito User Pools - User Flows
User Sign-Up and
Sign-In
User Profile Data Forgot Password
Token Based
Authentication
Email or Phone
Number
Verification
SMS Multifactor
Authentication

Cognito User Pool Authorizer
Supports authentication, but not authorization. Super easy!
E.g. you can lock down an API to Cognito User Pool users, but you don’t get
fine grained control over who can access which API resources.

Custom Authorizer
Supports authentication and authorization and super flexible!
• Function input: HTTP headers (e.g. Authorization header)
• Function output: Policy (e.g. allow GET /{userid}/profile, deny GET /admin)
• Result is cached for the input parameters (300 seconds default)
InternetMobile/Web
apps
AWS Lambda
functions
AWS
API Gateway
Other AWS
services
Custom
Authorizer
Function

Chalice – adding Cognito User Pools
from chalice import CognitoUserPoolAuthorizer
authorizer = CognitoUserPoolAuthorizer( 'MyPool', provider_arns=['arn:aws:cognito:...:userpool/name'])
...
...
def list_foods():
@app.route('/check_stock/{food}’, methods=['GET'], authorizer=authorizer)
try:
except KeyError:
@app.route('/add_food/{food}', methods=['PUT'], authorizer=authorizer)
def add_food(food):
Chalice

Chalice – adding Cognito User Pools
from chalice import CognitoUserPoolAuthorizer
authorizer = CognitoUserPoolAuthorizer( 'MyPool', provider_arns=['arn:aws:cognito:...:userpool/name'])
...
...
def list_foods():
@app.route('/check_stock/{food}’, methods=['GET'], authorizer=authorizer)
try:
except KeyError:
@app.route('/add_food/{food}', methods=['PUT'], authorizer=authorizer)
def add_food(food):
Chalice
authorization
required for certain
routes/methods
adding
authorization

Summary
It’s never been easier to build and launch APIs!
Serverless APIs:
• No management of servers
• Pay for what you use and not for idle resources!
• Instantly scale up without turning any knobs or provisioning any resources
• Tooling to get started in minutes with incredibly minimal code needed
• Built in high availability built into multiple places in the application stack
• Authentication and Authorization built into multiple places in the application
stack

aws.amazon.com/serverless

aws.amazon.com/serverless/developer-tools

Thank you

Serverless Development Deep Dive

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Serverless Development Deep Dive

Similar to Serverless Development Deep Dive (20)

More from Amazon Web Services

More from Amazon Web Services (20)

Serverless Development Deep Dive